# Confidential Computing Data is routinely encrypted at rest and in transit, and historically it had to be decrypted to be computed on, which left the processing moment as the gap in the chain. Confidential computing closes it: memory is encrypted by hardware with keys the host operating system and the hypervisor cannot read, so a workload runs without its data being legible to the infrastructure around it. > [!note] The one-sentence version > Encrypt memory with a key the operator does not hold, and the workload can run on somebody else's hardware without that somebody being able to read it. ## How it works The processor contains a security engine holding keys that software cannot extract. Memory belonging to a protected virtual machine or enclave is encrypted and integrity-protected by that engine, transparently to the workload. Access attempts from outside the protected context return ciphertext. **Attestation** is the complementary mechanism: the hardware produces a signed report describing what is running, which firmware, which measurements of the workload image, so that a relying party can verify the environment before releasing data or keys to it. The combination is what makes the guarantee usable: encryption prevents reading, and attestation proves to a remote party that the protection is genuinely in place. Implementations exist across the major server processor families, as enclaves within a process and, in the current generation, as whole confidential virtual machines, which is far easier to adopt since an unmodified workload can run inside one. ## Confidential accelerators Extending this to accelerator work is the development that matters for this collection. A model's weights and a user's prompts are both sensitive, and the arithmetic happens on the accelerator rather than the processor. Current accelerator generations support confidential modes in which accelerator memory is encrypted and the device participates in attestation, with the path between processor and accelerator protected. That permits a genuinely new arrangement: a model owner can serve weights on infrastructure it does not control without exposing them, and a data owner can submit data for inference without exposing it to the model owner or the operator. ## What it enables Regulated workloads in healthcare, finance, and government where data cannot be exposed to an operator; see [[wiki/Private Model Hosting|Private Model Hosting]]. Multi-party arrangements in which several institutions compute over combined data none of them may see in full. Protection of model weights as commercial assets when served in third-party facilities. And a stronger tenant boundary in bare-metal environments, where the usual hypervisor boundary is absent; see [[wiki/Bare Metal Compute|Bare Metal Compute]]. The honest limits deserve statement. The guarantee rests on the processor vendor's hardware and firmware being sound, side-channel research against these mechanisms is active and ongoing, and performance overhead varies with workload. The mechanism is strong and specific rather than absolute, and it has made categories of work possible that were previously confined to self-operated facilities. ## Relationships - **protects:** [[wiki/Private Model Hosting|Private Model Hosting]] · [[wiki/Inference Endpoint|Inference Endpoint]] · [[wiki/Bare Metal Compute|Bare Metal Compute]] - **implemented in:** [[wiki/Host CPU|Host CPU]] · [[wiki/Accelerator|Accelerator]] - **verified through:** attestation, alongside [[wiki/Supply Chain Security|Supply Chain Security]] - **part of:** [[wiki/Data Center Security|Data Center Security]] · [[wiki/Sovereign AI|Sovereign AI]] - **source articles:** [[articles/Vertically Integrating an AI Superpower from AI Factory to Citizen|Vertically Integrating an AI Superpower from AI Factory to Citizen]] · [[articles/The Gigawatt Is the New Measure of War|The Gigawatt Is the New Measure of War]] - **collection route:** [[collections/American Infrastructure|American Infrastructure]] · [[collections/American|American Collection]] ## Evidence posture - **Established:** hardware memory encryption and integrity protection with keys inaccessible to software; attestation producing signed environment reports for remote verification; process-level enclaves and whole confidential virtual machines across major server processor families; confidential accelerator modes with encrypted device memory and device participation in attestation in current accelerator generations. - **Established:** the dependence of the guarantee on vendor hardware and firmware soundness, active side-channel research against these mechanisms, and workload-dependent performance overhead. - **Strongly indicated:** confidential accelerator deployment enabling regulated and multi-party workloads previously confined to self-operated facilities; capability ships and production adoption is still developing. ## Sources - Processor and accelerator vendor confidential computing documentation and attestation specifications, as current October 2026.